source: postlfs/security/shadow/shadow-config.xml@ 409b449

10.0 10.1 11.0 11.1 6.0 6.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 krejzi/svn lazarus nosym perl-modules qt5new systemd-11177 systemd-13485 trunk upgradedb v1_0 v5_0 v5_0-pre1 v5_1 v5_1-pre1 xry111/intltool xry111/test-20220226
Last change on this file since 409b449 was 409b449, checked in by Larry Lawrence <larry@…>, 20 years ago

several edits in shadow - PAM section

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@468 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 3.2 KB
Line 
1<sect2>
2<title>Configuring PAM to work with shadow</title>
3
4<sect3><title>Config files</title>
5<para><userinput>/etc/pam.d/login /etc/pam.d/passwd /etc/pam.d/su
6/etc/pam.d/shadow /etc/pam.d/useradd</userinput></para>
7</sect3>
8
9<sect3><title>Configuration Information</title>
10
11<para>Add the following PAM configuration files to
12<filename>/etc/pam.d</filename> (or add them to
13<filename>/etc/pam.conf</filename> with
14the additional field for the program).
15</para>
16<screen><userinput>cat &gt; /etc/pam.d/login &lt;&lt; "EOF"</userinput>
17# Begin /etc/pam.d/login
18
19auth requisite pam_securetty.so
20auth requisite pam_nologin.so
21auth required pam_env.so
22auth required pam_unix.so
23account required pam_access.so
24account required pam_unix.so
25session required pam_motd.so
26session required pam_limits.so
27session optional pam_mail.so dir=/var/mail standard
28session optional pam_lastlog.so
29session required pam_unix.so
30
31# End /etc/pam.d/login
32<userinput>EOF
33cat &gt; /etc/pam.d/passwd &lt;&lt; "EOF"</userinput>
34# Begin /etc/pam.d/passwd
35
36password required pam_unix.so md5 shadow
37
38# End /etc/pam.d/passwd
39<userinput>EOF
40cat &gt; /etc/pam.d/shadow &lt;&lt; "EOF"</userinput>
41# Begin /etc/pam.d/shadow
42
43auth sufficient pam_rootok.so
44auth required pam_unix.so
45account required pam_unix.so
46session required pam_unix.so
47password required pam_permit.so
48
49# End /etc/pam.d/shadow
50<userinput>EOF
51cat &gt; /etc/pam.d/su &lt;&lt; "EOF"</userinput>
52# Begin /etc/pam.d/su
53
54auth sufficient pam_rootok.so
55auth required pam_unix.so
56account required pam_unix.so
57session required pam_unix.so
58
59# End /etc/pam.d/su
60<userinput>EOF
61cat &gt; /etc/pam.d/useradd &lt;&lt; "EOF"</userinput>
62# Begin /etc/pam.d/useradd
63
64auth sufficient pam_rootok.so
65auth required pam_unix.so
66account required pam_unix.so
67session required pam_unix.so
68password required pam_permit.so
69
70# End /etc/pam.d/useradd
71<userinput>EOF</userinput></screen>
72
73<para>Currently, <filename>/etc/pam.d/other</filename> is configured to
74allow anyone with an account on the machine to use programs
75that do not specifically have a configuration file of their own. After
76testing PAM for proper configuration, it can be changed to the
77following:</para>
78
79<screen><userinput>cat &gt; /etc/pam.d/other &lt;&lt; "EOF"</userinput>
80# Begin /etc/pam.d/other
81
82auth required pam_deny.so
83auth required pam_warn.so
84account required pam_deny.so
85session required pam_deny.so
86password required pam_deny.so
87password required pam_warn.so
88
89# End /etc/pam.d/other
90<userinput>EOF</userinput></screen>
91
92<para>Finally, edit <filename>/etc/login.defs</filename> by adding '#'
93to the beginning of the following lines:</para>
94<screen>DIALUPS_CHECK_ENAB
95LASTLOG_ENAB
96MAIL_CHECK_ENAB
97PORTTIME_CHECKS_ENAB
98CONSOLE
99MOTD_FILE
100NOLOGINS_FILE
101PASS_MIN_LEN
102SU_WHEEL_ONLY
103MD5_CRYPT_ENAB
104CONSOLE_GROUPS
105ENVIRON_FILE</screen>
106
107<para>This stops login from performing these functions, as they will now
108be performed by PAM modules.</para>
109
110</sect3>
111
112</sect2>
113
Note: See TracBrowser for help on using the repository browser.